CVE-2024-54000

CVE-2024-54000 affects MobSF prior to 3.9.7. The root cause is in _check_url using requests.get() with allow_redirects=True, enabling an SSRF when a .well-known/assetlinks.json response returns a 302 redirect. This bypasses the prior fix for CVE-2024-29190 and is fixed in MobSF 3.9.7. The connect...

CVE-2024-54000 Mobile Security Framework (MobSF) bypass of SSRF fix

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get request in the checkurl method is specified as allowredirects=True, which allows a server-side reque...

CVE-2024-54000 Mobile Security Framework (MobSF) bypass of SSRF fix

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get request in the checkurl method is specified as allowredirects=True, which allows a server-side reque...

SUSE-SU-2024:4145-1 Security update for wget

This update for wget fixes the following issues: - CVE-2024-10524: Fixed SSRF via shorthand HTTP URL bsc1233773...

Mobile Security Framework 安全漏洞

Mobile Security Framework MobSF is an automated all-in-one mobile application open-sourced by Mobile Security Framework. Used for penetration testing, malware analysis and security assessments, it is capable of performing both static and dynamic analysis. A security vulnerability exists in Mobile...

CBL Mariner 2.0 Security Update: python3 (CVE-2024-11168)

The version of python3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-11168 advisory. - The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that...

openSUSE Security Advisory (SUSE-SU-2024:4138-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Liberty Profile affect IBM Robotic Process Automation.

Summary Multiple vulnerabilities in IBM WebSphere Liberty Profile affect IBM Robotic Process Automation. IBM WebSphere Liberty Profile is used by IBM Robotic Process Automation as part of UMS and as an application server for container deployments. This bulletin identifies the security fixes to...

SUSE-SU-2024:4138-1 Security update for wget

This update for wget fixes the following issues: - CVE-2024-10524: Fixed SSRF via shorthand HTTP URL bsc1233773...

CVE-2024-53738

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through = 1.3.9.8...

CVE-2024-53738 WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through = 1.3.9.8...

CVE-2024-53738 WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.8...

CVE-2024-35451

LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF...

CVE-2024-35451

LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF...

CVE-2024-35451

LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF...

CVE-2024-35451

CVE-2024-35451 affects LinkStack versions 2.7.9–4.7.7. A server-side request forgery vulnerability exists in resources/views/components/favicon.blade.php, enabling SSRF via a crafted link. Documented impact includes risk of local network access; no exploit details are provided in the sources. Rem...

openSUSE Security Advisory (SUSE-SU-2024:4109-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:4109-1 Security update for libuv

This update for libuv fixes the following issues: - CVE-2024-24806: Fixed improper Domain Lookup that potentially leads to SSRF attacks bsc1219724...

GO-2024-3289 OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console

OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console...

Security Bulletin: IBM Analytics Content Hub is affected by security vulnerabilities

Summary There are vulnerabilities in multiple Open Source Software OSS components consumed by IBM Analytics Content Hub. Additionally, IBM Analytics Content Hub is vulnerable to Buffer Overflow, Server Side Request Forgery SSRF and Improper Error Handling vulnerabilities. Please refer to the tabl...